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We claim: 

1 1 . A method of clustering a plurality of client IP addresses within a distributed information 

2 network, the method comprising the steps of: 

3 generating a unified prefix/netmask table from a plurality of network routing table 

4 prefix/netmask entries; 

5 comparing each of the plurality of client IP addresses with the unified prefix/netmask 

6 table to determine a common prefix between each of the plurality of client IP addresses and at 

7 least one of the entries in the unified prefix/netmask table; and 

8 grouping client IP addresses which share a common prefix into a network client cluster. 

1 2. The method of claim 1 , wherein the step of generating a unified prefix/netmask table 

2 from a plurality of network routing table prefix/netmask entries includes the steps of: 

3 extracting the prefix/netmask entries from a plurality of network routing tables; and 

4 converting the prefix/netmask entries into a standardized format. 

1 3. The method of claim 1 , wherein the client IP addresses are extracted from a network log. 

1 4. The method of claim 3, further comprising: 

2 identifying existing spiders and/or proxies within the network log. 

1 5. The method of claim 1 , further comprising: 

2 placing one or more servers in front of a network client cluster, wherein the servers are at 

3 least one of proxy servers, cache servers, content distribution servers and mirror servers. 

1 6. The method of claim 1 , wherein the common prefix is the common longest matching 

2 prefix from the unified prefix/netmask table. 

1 7. The method of claim 1 , wherein the distributed information network is the World Wide 

2 Web. 
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1 8. A method for guiding placement of servers within a distributed information network 

2 using at least one network server log and at least one network routing table from the distributed 

3 information network, the method comprising: 

4 extracting a plurality of prefix/netmask entries from the at least one network routing 

5 table; 

6 generating a unified prefix/netmask table from the plurality of extracted prefix/netmask 

7 entries; 

8 extracting a plurality of client IP addresses from the at least one network server log; 

9 comparing each of the plurality of client IP addresses with entries in the unified/prefix 

10 netmask table to determine a common longest matching prefix between each of the plurality of 

1 1 client IP addresses and the entries in the unified/prefix netmask table; and 

CI 12 grouping all of the client IP addresses which share the common longest matching prefix 

"if 13 into at least one client cluster. 
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ri 1 9. The method of claim 8, wherein generating a unified prefix/netmask table from the 

2 plurality of extracted prefix/netmask entries includes: 

s 3 converting the prefix/netmask entries into a standardized format. 
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pJ l 10. The method of claim 8, wherein the servers are selected from the group consisting of 

Ui-f 

o 2 proxy servers, cache servers, content distribution servers and mirror servers. 

1 11. The method of claim 8, wherein each client cluster is assigned one or more servers. 

1 12. The method of claim 8, further comprising: 

2 assigning one or more servers to each client cluster based on the number of requests 

3 issued by the clients within each client cluster. 
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1 13. A method for clustering clients, the method comprising: 

2 creating a unified table of routing address information; 

3 comparing one or more client IP addresses with the unified routing table to determine 

4 which client IP addresses belong to a common network; and 

5 clustering together the client IP addresses which belong to the common network into 

6 client clusters. 

1 1 4. The method of claim 1 3, wherein the routing address information is prefix/netmask 

2 information extracted from a plurality of routing tables. 

1 15. The method of claim 1 3, wherein the common network is defined by a common longest 
C3 2 matching prefix shared by each of the client IP addresses. 

^ 1 1 6. The method of claim 1 3, wherein creating a unified table of routing address information 

M 2 includes: 

j= 3 extracting a plurality of entries from a plurality of routing tables; 

= 4 unifying the plurality of entries into a consistent format; and 

Qi 5 merging the plurality of entries into the unified table. 

nj 

O 1 17. The method of claim 1 3, wherein comparing one or more client IP addresses with the 

2 unified routing table to determine which client IP addresses belong to a common network 

3 includes extracting the one or more IP addresses from at least one server log. 

1 18. The method of claim 1 3, further comprising: 

2 assigning servers to client clusters based on the number of clients comprising each client 

3 cluster and the number of requests issued by those clients. 

1 1 9. The method of claim 13, further comprising: 

2 assigning servers to the client clusters, wherein the servers are at least one of proxy 

3 servers, cache servers, content distribution servers and mirror server. 
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1 20. A computer-readable medium storing executable instructions which cause a computer to 

2 perform the steps of: 

3 creating a unified routing table from a plurality of routing table entries extracted from 

4 two or more network routing tables; 

5 prefix matching a plurality of client IP addresses with the entries in the unified routing 

6 table; and 

7 clustering client IP addresses which share common prefixes from the unified routing table 

8 into client clusters, wherein each client cluster will be serviced by at least one proxy server. 

1 21 . The computer-readable medium of claim 20, wherein creating a unified routing table 

2 from a plurality of routing table entries extracted from two or more network routing tables 

3 includes converting the plurality of routing table entries into a standardized format. 

1 22. The computer-readable medium of claim 20, wherein the plurality of client IP addresses 

2 are extracted from a server log. 

1 23. The computer-readable medium of claim 20, wherein the common prefix is the longest 

2 matching prefix between the IP addresses in a client cluster and one of the unified routing table 

3 entries. 

1 24. The computer-readable medium of claim 20, wherein the server is one of a proxy server, 

2 a cache server, a content distribution server and a mirror server. 
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